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May 27, 2022 


Ms. Shira Perlmutter 

Register of Copyrights 

United States Copyright Office 
101 Independence Ave., SE 
Washington, DC 20559 


Re: Standard Technical Measures and Section 512 [Docket Number 2022-2] 


Dear Ms. Perlmutter: 


BSA | The Software Alliance (BSA) appreciates the opportunity to provide feedback in 
response to the Copyright Office’s Notice of Inquiry regarding Standard Technical Measures 
and Section 512.1 BSA is the leading advocate for the global enterprise software industry. 
Our members provide a wide range of offerings, including cloud infrastructure and hosting 
services, customer relationship management software, human resources management 
programs, identity management services, cybersecurity solutions, and collaboration 
software.? While their service offerings vary, a unifying characteristic of BSA member 
companies is that their business models are predicated on licensing and sales of intellectual 
property. BSA members therefore share the underlying goal of ensuring the Digital 


Millennium Copyright Act (DMCA) remains fit-for-purpose. 


BSA members rely on the DMCA both as rights owners and as online service providers. As 
owners of copyrighted works subject to high levels of infringement, BSA members utilize the 


DMCA’s takedown provisions to enforce their rights online. At the same time, BSA members 


t U.S. Copyright Office, Library of Congress, Standard Technical Measures and Section 512, 87 Fed. 
Reg. 25049 (Apr. 27, 2022). 

2 BSA’s members include: Adobe, Alteryx, Atlassian, Autodesk, Bentley Systems, Box, Cisco, 
CNC/Mastercam, CrowdStrike, DocuSign, Dropbox, Graphisoft, IBM, Informatica, Intel, MathWorks, 
Microsoft, Okta, Oracle, Prokon, PTC, Salesforce, SAP, ServiceNow, Shopify Inc., Siemens Industry 
Software Inc., Splunk, Trend Micro, Trimble Solutions Corporation, TriNet, Twilio, Unity Technologies, 
Inc., Workday, Zendesk, and Zoom Video Communications, Inc. 
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also rely on the legal certainty afforded by the DMCA’s safe harbors to provide a vast array of 
online services that enable their enterprise customers to thrive. Given our members’ 
experience operating as both copyright owners and service providers, we write today to 
highlight a few issues for consideration as the Copyright Office develops recommendations to 
Congress about how to overcome the challenges that have thwarted efforts to develop 
“standard technical measures” (STMs) as they were envisioned when Section 512(i) was 
codified. These issues are fundamental to the Office’s undertaking and cut across many of 


the questions posed in the Notice. 


Section 512(i) Envisions Consensus Around “One-Size-Fits-All” Technical Measures 


In our view, the principal impediment to the development of STMs largely derives from the 
DMCA’s statutory text and its presupposition that the broad range of DMCA “service 
providers” will be able to accommodate specific technical measures. Section 512(i) conditions 
eligibility for the DMCA’s safe harbor on “service providers” accommodating STMs that have 
been “developed pursuant to a broad consensus of copyright owners and services providers.” 
Of course, the universe of actors that fall within the DMCA’s definition of “service provider” is 
incredibly vast and includes: (1) mere conduits (e.g., internet access providers), (2) caching 
providers (e.g., intermediary services aimed at enhancing network reliability and 
performance), (3) hosting services (e.g., services that store material at the direction of a 
user), and (4) information location tools (e.g., search engines). The combination of the 
DMCA’s broad definition of “service provider” and Section 512(i)’s requirement that STMs 
garner “broad consensus” among those services thus implies that there may be technical 
solutions that that could reasonably be accommodated by at least a meaningful proportion of 


the diverse range of online services that rely on the DMCA. 


Insofar as Section 512(i) requires a “broad consensus” of copyright owners and internet 
access providers, caching providers, hosting providers, and search engines, it is unlikely that 
any technical measure will meet the statutory requirements to be considered an “STM.” Of 
course, that shouldn’t come as a surprise. As the Copyright Office has noted, such one-size- 


fits-all approaches are unlikely to be effective “since those measures that are appropriate for 
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one category of OSP may be a poor fit for OSPs that feature different kinds of content or 


perform different functions.”? 


Filtering Technologies are Inappropriate for Most Service Providers 


The challenge posed by Section 512(i)’s requirement for “broad consensus” among the 
diverse universe of DMCA “service providers” is compounded by the fact that technical 
measures are appropriate for a very narrow class of services. As the Copyright Office has 
noted, discussions about potential standard technical measures are focused on 
“filtering/fingerprinting systems” that enable some service providers to proactively monitor 
network activity to identify potentially infringing activity. While some of the world’s largest 
consumer-facing social media and UGC platforms have voluntarily adopted filtering solutions, 
such solutions could not be adopted by the vast majority of DMCA service providers, raising 


technical or legal challenges, or both. 


Even within the subset of service providers that rely on the Section 512(c) safe harbor (i.e., 
“hosting providers”) the technical feasibility and appropriateness of filtering solutions varies 
widely. Section 512(c) covers any service that provides “storage at the direction of a user” 
(i.e., hosting). Although much of the litigation involving Section 512(c) has involved 
consumer-facing UGC platforms, the universe of online services that fall within the scope of 
Section 512(c) is incredibly vast. Indeed, the ability to store content is at the heart of virtually 
every enterprise B2B cloud offering, from software-as-a-service to infrastructure-as-a-service. 
For most of these services, the use of filtering technologies would pose significant technical 


challenges and implicate grave cybersecurity and privacy concerns. 


The online services provided by BSA members to their enterprise customers are used 
overwhelmingly for legitimate purposes and in support of critical business operations. While 
the use of filtering technologies by UGC platforms can in some circumstances be reasonable, 
imposing a blanket requirement on enterprise service providers would result in unintended — 
and potentially catastrophic — impacts. BSA members provide cloud-based tools and services 
to enterprise customers, including organizations in the healthcare, banking, energy, and 
defense industries. Given the sensitivity of their customers’ data, enterprise cloud service 


providers design their systems so that they have limited — if any — visibility into the data they 


3 Copyright Office Section 512 Report at 176. 
* Copyright Office Section 512 Report at 178. 
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are hosting and/or processing on behalf of their clients. Imposing a filtering requirement on 
enterprise cloud service providers — e.g., infrastructure-as a- service providers and platform- 
as-a-service providers -- would thus require them to reengineer their networks in ways that 
would create significant privacy and security concerns. It could, for instance, prevent 
enterprise service providers from offering user-controlled encryption protections that are 
critical to the security of sensitive data. Such an outcome could place service providers out of 


compliance with legal and contractual obligations, thus exposing them to potential liability. 


Potential Paths Forward 


As the Copyright Office considers recommendations to Congress about how the original 
goals of Section 512(i) can be realized, we urge you to focus on the obstacles highlighted 
above. STMs have yet to arise because the DMCA casts far too wide of a net in seeking to 
drive consensus for technical measures that can be accommodated by the wide range of 
actors that fall within the definition of “service provider.” The Copyright Office should 
recognize that this one-size-fits-all approach to technical measures is no more likely to ever 
generate the “broad consensus” necessary for a technology to be deemed an STM now than 


it has been over the past 20 years. 


Furthermore, given that the technical measures ultimately at issue are filtering technologies, 
the Copyright Office should also be guided by its own conclusions in the Section 512 Report 
regarding the need for careful consideration of their “non-copyright implications.” As noted 
above, the application of filtering technologies raises significant privacy and cybersecurity 
concerns for many hosting service providers. It is for these reasons that the European Union 
specifically exempts enterprise hosting providers from technical measures requirements in 
the recently codified Directive on Copyright in the Digital Single Market.® Article 17 of the 
Directive is a de facto requirement for UGC-oriented services’ to implement filtering 
mechanisms to prevent the availability of infringing content. Critically, Article 17 implicitly 


acknowledges that such a requirement would be inappropriate for the vast majority of online 


5 Copyright Office Section 512 Report at pg. 193. 

ê Directive 2019/790 of the European Parliament and of the Council of 17 April 2019 on Copyright and 
Related Rights in the Digital Single Market and Amending Council Directives 96/9/EC and 2001/29/EC, 
2019 O.J. (L. 130) (“DSM Copyright Directive”). 

7 The DSM Copyright Directive refers to such services as “online content-sharing service providers,” 
which are designed with a predominant purpose of hosting and providing “public access to a large 
amount of copyright-protected works or other protected subject matter uploaded by its users, which 
it organises and promotes for profit-making purposes.” DSM Copyright Directive, article 2(6) 
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services. Accordingly, the DSM Copyright Directive’s Article 17 requirement applies only to 
the subset of hosting providers that meet the very narrow definition of “online content-sharing 
service providers.” Notably the definition of “online content sharing service providers” 
explicitly excludes “business-to-business cloud services,” open-source software development 


platforms, and online marketplaces. ê 


Should the Copyright Office determine legislative changes to Section 512(i) are necessary, 
we urge you to consider options for more narrowly tailoring the class of services that could be 
subject to a “standard technical measures” requirement or rulemaking. Rather than focusing 
on “service providers” generally, the Copyright Office should consider targeting the specific 
subset of service providers for which filtering requirements may be appropriate and explicitly 
excluding B2B providers for whom filtering requirements would raise significant concerns. 
Consistent with the approach in the EU, the Copyright Office should seek to focus Section 
512(i) on the limited subset of 512(c) hosting services that pose the greatest risk of online 
infringement. We urge that any recommendations put forward by the Office differentiate 
among online services based on a data-driven assessment of the risk such services pose to 
online infringement. The anecdotal, technical, or theoretical capability of a service or type of 
service to be used to host infringing content should neither trigger an obligation to implement 
STMs nor prejudice the availability of a DMCA liability safe harbor. 


BSA appreciates the opportunity to provide feedback on these critically important issues and 


we look forward to remaining engaged as the Copyright Office considers next steps. 


Sincerely, 


ree 


Christian Troncoso 
Senior Director, Policy 


8 DSM Copyright Directive, article 2(6). 
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